This is more of a technology related thing, so better post such questions in the Tech forum. That said, do you mean client side validations (i.e. the user can't type anything but the characters you want) or server side (i.e. the user can type anything they want, and you check it afterwards + give an error). The former must be done via JavaScript (you could look at the CustomMask forge component, but it's buggy). The latter can e.g. be done via a RegEx.